Threats tagged 'ghsa-cfjx-qgfm-vmq8'

smart-sso versions through 2.0.1 have an incorrect authorization vulnerability in the PermissionFilter component. This flaw allows any authenticated user to access admin console APIs because unlisted paths are permitted by default. Exploitation enables attackers to call sensitive endpoints such as /admin/user-role/save to assign themselves administrator privileges, reset passwords, and manage users, roles, and applications across integrated systems.